…423.2 (#66482)

On relative base path root
Microsoft.SourceBuild.Intermediate.arcade , Microsoft.DotNet.Arcade.Sdk , Microsoft.DotNet.Build.Tasks.Installers , Microsoft.DotNet.Build.Tasks.Templating , Microsoft.DotNet.Helix.Sdk , Microsoft.DotNet.RemoteExecutor From Version 9.0.0-beta.26201.6 -> To Version 9.0.0-beta.26223.2

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>

…0260415.2 (#66371)

On relative base path root
Microsoft.Extensions.Diagnostics.Testing , Microsoft.Extensions.TimeProvider.Testing From Version 10.6.0-preview.1.26210.2 -> To Version 10.6.0-preview.1.26215.2

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>

…otnet-efcore build 20260505.7

On relative base path root
dotnet-ef , Microsoft.EntityFrameworkCore , Microsoft.EntityFrameworkCore.Design , Microsoft.EntityFrameworkCore.InMemory , Microsoft.EntityFrameworkCore.Relational , Microsoft.EntityFrameworkCore.Sqlite , Microsoft.EntityFrameworkCore.SqlServer , Microsoft.EntityFrameworkCore.Tools From Version 9.0.16 -> To Version 9.0.17

… aliases

Fixed issue where in grpc transcoding query parameter processing overwrites route or body-bound fields. Also fixing unmatched query parameters stored in the descriptor cache

…validation

Enforce a check for non-ASCII characters in the :path header for HTTP2/HTTP3. HTTP1 is not impacted

----
#### AI description  (iteration 1)
#### PR Classification
Bug fix to enforce ASCII validation for HTTP/2 and HTTP/3 `:path` header processing.

#### PR Summary
Adds runtime validation for non-ASCII/control characters in the `:path` segment for HTTP/2 and HTTP/3 streams, aborting the stream with a protocol error instead of relying on `Debug.Assert`.
- `src/Servers/Kestrel/Core/src/Internal/Http2/Http2Stream.cs`: Replace `Debug.Assert` with explicit ASCII-range check; reset/abort the stream with `PROTOCOL_ERROR` on invalid characters.
- `src/Servers/Kestrel/Core/src/Internal/Http3/Http3Stream.cs`: Replace `Debug.Assert` with explicit ASCII-range check; abort the stream with `ProtocolError` on invalid characters.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->

…-merge-9.0-2026-05-12-1248

If auth middleware was after the output caching middleware and some other auth was used besides the authorization header, then apps could end up caching a page meant for a specific user and then serve the cached page for anonymous or other users.

…otnet-efcore build 20260512.4

On relative base path root
dotnet-ef , Microsoft.EntityFrameworkCore , Microsoft.EntityFrameworkCore.Design , Microsoft.EntityFrameworkCore.InMemory , Microsoft.EntityFrameworkCore.Relational , Microsoft.EntityFrameworkCore.Sqlite , Microsoft.EntityFrameworkCore.SqlServer , Microsoft.EntityFrameworkCore.Tools From Version 9.0.16 -> To Version 9.0.17

…otnet-efcore build 20260512.8

On relative base path root
dotnet-ef , Microsoft.EntityFrameworkCore , Microsoft.EntityFrameworkCore.Design , Microsoft.EntityFrameworkCore.InMemory , Microsoft.EntityFrameworkCore.Relational , Microsoft.EntityFrameworkCore.Sqlite , Microsoft.EntityFrameworkCore.SqlServer , Microsoft.EntityFrameworkCore.Tools From Version 9.0.16 -> To Version 9.0.17

…6-05-12-1248

Merging internal commits for release/9.0

…otnet-runtime build 20260512.28

On relative base path root
Microsoft.Bcl.AsyncInterfaces , Microsoft.Bcl.TimeProvider , Microsoft.Extensions.Caching.Abstractions , Microsoft.Extensions.Caching.Memory , Microsoft.Extensions.Configuration , Microsoft.Extensions.Configuration.Abstractions , Microsoft.Extensions.Configuration.Binder , Microsoft.Extensions.Configuration.CommandLine , Microsoft.Extensions.Configuration.EnvironmentVariables , Microsoft.Extensions.Configuration.FileExtensions , Microsoft.Extensions.Configuration.Ini , Microsoft.Extensions.Configuration.Json , Microsoft.Extensions.Configuration.UserSecrets , Microsoft.Extensions.Configuration.Xml , Microsoft.Extensions.DependencyInjection , Microsoft.Extensions.DependencyInjection.Abstractions , Microsoft.Extensions.DependencyModel , Microsoft.Extensions.Diagnostics , Microsoft.Extensions.Diagnostics.Abstractions , Microsoft.Extensions.FileProviders.Abstractions , Microsoft.Extensions.FileProviders.Composite , Microsoft.Extensions.FileProviders.Physical , Microsoft.Extensions.FileSystemGlobbing , Microsoft.Extensions.Hosting , Microsoft.Extensions.Hosting.Abstractions , Microsoft.Extensions.Http , Microsoft.Extensions.Logging , Microsoft.Extensions.Logging.Abstractions , Microsoft.Extensions.Logging.Configuration , Microsoft.Extensions.Logging.Console , Microsoft.Extensions.Logging.Debug , Microsoft.Extensions.Logging.EventLog , Microsoft.Extensions.Logging.EventSource , Microsoft.Extensions.Logging.TraceSource , Microsoft.Extensions.Options , Microsoft.Extensions.Options.ConfigurationExtensions , Microsoft.Extensions.Options.DataAnnotations , Microsoft.Extensions.Primitives , Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 , System.Collections.Immutable , System.Composition , System.Configuration.ConfigurationManager , System.Diagnostics.DiagnosticSource , System.Diagnostics.EventLog , System.Diagnostics.PerformanceCounter , System.DirectoryServices.Protocols , System.IO.Hashing , System.IO.Pipelines , System.Net.Http.Json , System.Net.Http.WinHttpHandler , System.Net.ServerSentEvents , System.Reflection.Metadata , System.Resources.Extensions , System.Runtime.Caching , System.Security.Cryptography.Pkcs , System.Security.Cryptography.Xml , System.Security.Permissions , System.ServiceProcess.ServiceController , System.Text.Encodings.Web , System.Text.Json , System.Threading.AccessControl , System.Threading.Channels , System.Threading.RateLimiting From Version 9.0.16 -> To Version 9.0.17
Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , Microsoft.SourceBuild.Intermediate.runtime.linux-x64 From Version 9.0.16-servicing.26229.23 -> To Version 9.0.17-servicing.26262.28

…otnet-runtime build 20260514.6

On relative base path root
Microsoft.Bcl.AsyncInterfaces , Microsoft.Bcl.TimeProvider , Microsoft.Extensions.Caching.Abstractions , Microsoft.Extensions.Caching.Memory , Microsoft.Extensions.Configuration , Microsoft.Extensions.Configuration.Abstractions , Microsoft.Extensions.Configuration.Binder , Microsoft.Extensions.Configuration.CommandLine , Microsoft.Extensions.Configuration.EnvironmentVariables , Microsoft.Extensions.Configuration.FileExtensions , Microsoft.Extensions.Configuration.Ini , Microsoft.Extensions.Configuration.Json , Microsoft.Extensions.Configuration.UserSecrets , Microsoft.Extensions.Configuration.Xml , Microsoft.Extensions.DependencyInjection , Microsoft.Extensions.DependencyInjection.Abstractions , Microsoft.Extensions.DependencyModel , Microsoft.Extensions.Diagnostics , Microsoft.Extensions.Diagnostics.Abstractions , Microsoft.Extensions.FileProviders.Abstractions , Microsoft.Extensions.FileProviders.Composite , Microsoft.Extensions.FileProviders.Physical , Microsoft.Extensions.FileSystemGlobbing , Microsoft.Extensions.Hosting , Microsoft.Extensions.Hosting.Abstractions , Microsoft.Extensions.Http , Microsoft.Extensions.Logging , Microsoft.Extensions.Logging.Abstractions , Microsoft.Extensions.Logging.Configuration , Microsoft.Extensions.Logging.Console , Microsoft.Extensions.Logging.Debug , Microsoft.Extensions.Logging.EventLog , Microsoft.Extensions.Logging.EventSource , Microsoft.Extensions.Logging.TraceSource , Microsoft.Extensions.Options , Microsoft.Extensions.Options.ConfigurationExtensions , Microsoft.Extensions.Options.DataAnnotations , Microsoft.Extensions.Primitives , Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 , System.Collections.Immutable , System.Composition , System.Configuration.ConfigurationManager , System.Diagnostics.DiagnosticSource , System.Diagnostics.EventLog , System.Diagnostics.PerformanceCounter , System.DirectoryServices.Protocols , System.IO.Hashing , System.IO.Pipelines , System.Net.Http.Json , System.Net.Http.WinHttpHandler , System.Net.ServerSentEvents , System.Reflection.Metadata , System.Resources.Extensions , System.Runtime.Caching , System.Security.Cryptography.Pkcs , System.Security.Cryptography.Xml , System.Security.Permissions , System.ServiceProcess.ServiceController , System.Text.Encodings.Web , System.Text.Json , System.Threading.AccessControl , System.Threading.Channels , System.Threading.RateLimiting From Version 9.0.16 -> To Version 9.0.17
Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , Microsoft.SourceBuild.Intermediate.runtime.linux-x64 From Version 9.0.16-servicing.26229.23 -> To Version 9.0.17-servicing.26264.6

…otnet-runtime build 20260514.16

On relative base path root
Microsoft.Bcl.AsyncInterfaces , Microsoft.Bcl.TimeProvider , Microsoft.Extensions.Caching.Abstractions , Microsoft.Extensions.Caching.Memory , Microsoft.Extensions.Configuration , Microsoft.Extensions.Configuration.Abstractions , Microsoft.Extensions.Configuration.Binder , Microsoft.Extensions.Configuration.CommandLine , Microsoft.Extensions.Configuration.EnvironmentVariables , Microsoft.Extensions.Configuration.FileExtensions , Microsoft.Extensions.Configuration.Ini , Microsoft.Extensions.Configuration.Json , Microsoft.Extensions.Configuration.UserSecrets , Microsoft.Extensions.Configuration.Xml , Microsoft.Extensions.DependencyInjection , Microsoft.Extensions.DependencyInjection.Abstractions , Microsoft.Extensions.DependencyModel , Microsoft.Extensions.Diagnostics , Microsoft.Extensions.Diagnostics.Abstractions , Microsoft.Extensions.FileProviders.Abstractions , Microsoft.Extensions.FileProviders.Composite , Microsoft.Extensions.FileProviders.Physical , Microsoft.Extensions.FileSystemGlobbing , Microsoft.Extensions.Hosting , Microsoft.Extensions.Hosting.Abstractions , Microsoft.Extensions.Http , Microsoft.Extensions.Logging , Microsoft.Extensions.Logging.Abstractions , Microsoft.Extensions.Logging.Configuration , Microsoft.Extensions.Logging.Console , Microsoft.Extensions.Logging.Debug , Microsoft.Extensions.Logging.EventLog , Microsoft.Extensions.Logging.EventSource , Microsoft.Extensions.Logging.TraceSource , Microsoft.Extensions.Options , Microsoft.Extensions.Options.ConfigurationExtensions , Microsoft.Extensions.Options.DataAnnotations , Microsoft.Extensions.Primitives , Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 , System.Collections.Immutable , System.Composition , System.Configuration.ConfigurationManager , System.Diagnostics.DiagnosticSource , System.Diagnostics.EventLog , System.Diagnostics.PerformanceCounter , System.DirectoryServices.Protocols , System.IO.Hashing , System.IO.Pipelines , System.Net.Http.Json , System.Net.Http.WinHttpHandler , System.Net.ServerSentEvents , System.Reflection.Metadata , System.Resources.Extensions , System.Runtime.Caching , System.Security.Cryptography.Pkcs , System.Security.Cryptography.Xml , System.Security.Permissions , System.ServiceProcess.ServiceController , System.Text.Encodings.Web , System.Text.Json , System.Threading.AccessControl , System.Threading.Channels , System.Threading.RateLimiting From Version 9.0.16 -> To Version 9.0.17
Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , Microsoft.SourceBuild.Intermediate.runtime.linux-x64 From Version 9.0.16-servicing.26229.23 -> To Version 9.0.17-servicing.26264.16

…otnet-efcore build 20260515.3

On relative base path root
dotnet-ef , Microsoft.EntityFrameworkCore , Microsoft.EntityFrameworkCore.Design , Microsoft.EntityFrameworkCore.InMemory , Microsoft.EntityFrameworkCore.Relational , Microsoft.EntityFrameworkCore.Sqlite , Microsoft.EntityFrameworkCore.SqlServer , Microsoft.EntityFrameworkCore.Tools From Version 9.0.16 -> To Version 9.0.17

…ng/internal/dotnet-efcore, dnceng/internal/dotnet-runtime

This pull request updates the following dependencies

[marker]: <> (Begin:67a6df8f-40a9-4218-839a-e336f1bd1d79)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-efcore
- **Subscription**: [67a6df8f-40a9-4218-839a-e336f1bd1d79](https://maestro.dot.net/subscriptions?search=67a6df8f-40a9-4218-839a-e336f1bd1d79)
- **Build**: [20260515.3](https://dev.azure.com/dnceng/internal/_build/results?buildId=2976013) ([314621](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-efcore/build/314621))
- **Date Produced**: May 16, 2026 7:54:52 PM UTC
- **Commit**: [46c88f8ca38ff2f5b3c202f4d016f23918ab62e8](https://dev.azure.com/dnceng/internal/_git/dotnet-efcore?_a=history&version=GC46c88f8ca38ff2f5b3c202f4d016f23918ab62e8)
- **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-efcore?version=GBrefs/heads/internal/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.16 to 9.0.17][4]
     - dotnet-ef
     - Microsoft.EntityFrameworkCore
     - Microsoft.EntityFrameworkCore.Design
     - Microsoft.EntityFrameworkCore.InMemory
     - Microsoft.EntityFrameworkCore.Relational
     - Microsoft.EntityFrameworkCore.Sqlite
     - Microsoft.EntityFrameworkCore.SqlServer
     - Microsoft.EntityFrameworkCore.Tools

[4]: https://dev.azure.com/dnceng/internal/_git/dotnet-efcore/branches?baseVersion=GC60c2e9b8f50634a077d6c4d2a2a73a7f643c9b11&targetVersion=GC46c88f8ca38ff2f5b3c202f4d016f23918ab62e8&_a=files

[DependencyUpdate]: <> (End)

[marker]: <> (End:67a6df8f-40a9-4218-839a-e336f1bd1d79)

[marker]: <> (Begin:ff8719c2-a1bf-4aef-ad09-b38561e103bc)
## From https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- **Subscription**: [ff8719c2-a1bf-4aef-ad09-b38561e103bc](https://maestro.dot.net/subscriptions?search=ff8719c2-a1bf-4aef-ad09-b38561e103bc)
- **Build**: [20260512.28](https://dev.azure.com/dnceng/internal/_build/results?buildId=2973482) ([314186](https://maestro.dot.net/channel/5128/azdo:dnceng:internal:dotnet-runtime/build/314186))
- **Date Produced**: May 13, 2026 6:50:37 PM UTC
- **Commit**: [f6c6e5a804985291dc5b518a061de1c493beb5dc](https://dev.azure.com/dnceng/internal/_git/dotnet-runtime?_a=history&version=GCf6c6e5a804985291dc5b518a061de1c493beb5dc)
- **Branch**: [refs/heads/internal/release/9.0](https://dev.azure.com/dnceng/internal/_git/dotnet-runtime?version=GBrefs/heads/internal/release/9.0)

[DependencyUpdate]: <> (Begin)

- **Dependency Updates**:
  - From [9.0.16 to 9.0.17][4]
     - Microsoft.Bcl.AsyncInterfaces
     - Microsoft.Bcl.TimeProvider
     - Microsoft.Extensions.Caching.Abstractions
     - Microsoft.Extensions.Caching.Memory
     - Microsoft.Extensions.Configuration
     - Microsoft.Extensions.Configuration.Abstractions
     - Microsoft.Extensions.Configuration.Binder
     - Microsoft.Extensions.Configuration.CommandLine
     - Microsoft.Extensions.Configuration.EnvironmentVariables
     - Microsoft.Extensions.Configuration.FileExtens...

#### AI description  (iteration 3)
#### PR Classification
Dependency update with security fix for MessagePack library to address stack overflow vulnerability in deeply nested structure parsing.

#### PR Summary
This PR updates MessagePack from version 2.5.187 to 2.5.301 and applies patches to the MessagePack-CSharp submodule to fix a stack overflow issue when parsing deeply nested array structures.

- `eng/Versions.props`: Updated MessagePackVersion from 2.5.187 to 2.5.301
- `eng/build.ps1` and `eng/build.sh`: Added logic to apply two patch files (`upstream-patch.diff` and `msgpack-fix-full.diff`) to the MessagePack-CSharp submodule during build
- `MessagePackHubProtocolTestBase.cs`: Added test `SkipResult_WithDeeplyNestedStructure` to verify handling of 100,000 nested arrays without stack overflow
- `.gitattributes`: Enforced LF line endings for `.diff` and `.patch` files to ensure proper parsing by `git apply`
- `eng/scripts/CodeCheck.ps1`: Excluded `src/submodules/MessagePack-CSharp` from changed files checks
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->